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Privacy Concerns: The Effects 
of the Latest FERPA Changes 

By Christine Cossler 



P rivacy, something once 
taken for granted, has 
again become top-of-mind 
for public school districts 
thanks to technology’s increasing 
reach, as well as new changes to pri- 
vacy laws governing student 
information. 

Recently, educators have had to 
face important changes to the Family 
Educational Rights and Privacy Act 
(FERPA), originally signed into law in 
1974. As school business officials are 
more than aware, FERPA has a 
twofold purpose: (1) to ensure that 
parents have access to their children’s 
education records and (2) to protect 
the privacy rights of both parents and 
children by limiting access to those 
records without parental consent. 

The latest round of amendments to 
this 35-year-old law went into effect 


on January 8, strengthening some 
areas of privacy and clarifying oth- 
ers. Many of these amendments 
codify positions taken by courts over 
the years in interpreting FERPA, 
while other amendments impose new 
requirements. 

All changes affect how school 
districts must handle such issues as 
school safety, access to education data 
for research and accountability, and 
the safeguarding of education records. 

The most significant changes affect 
the following areas: 

Attendance 

Directory information and per- 
sonally identifiable information 
Disclosure 

Definition of education records 
School officials exception 
Control of access to education 
records by school officials 


Records to a student’s new school 
Ex parte court orders under USA 
PATRIOT Act 
Registered sex offenders 
Identification and authentication 
of identity of parties requesting 
education records disclosure 
Efealth and safety emergencies 
Student identification and com- 
munication in class for opt-outs 
Enforcement provisions 
Obviously, the goal of these new 
changes is to provide students with 
a quality education in a safe environ- 
ment — with the knowledge that their 
privacy is protected. But what bur- 
dens of accountability now rest on 
your shoulders to ensure that goal? 
What changes do you need to make? 
And what do you need to know 
about the ongoing bolstering of 
privacy issues in public education? 
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This article should familiarize you with the most 
recent FERPA changes and help you stay within the law 
when you receive a public records request or when other 
issues arise pertaining to the privacy of your district’s 
education records. 

Attendance 

The final regulations amend the definition of “atten- 
dance” to encompass other situations in which students 
“attend” class but are not necessarily present physically. 
They include videoconference, satellite, the Internet, and 
other electronic information and telecommunications 
technologies. 

The new amendment also clarifies that covered stu- 
dents include those who receive instruction through 
distance learning and other contemporary modalities. 

Directory Information and Personally 

Identifiable Information 

Under past FERPA regulations, schools could disclose 
directory information about former students without 
providing notice as otherwise required or an additional 
opt-out opportunity. The most recent changes now 
require schools to honor a former student’s opt-out 
request made while in attendance, unless it has been 
specifically rescinded by the former student. 

Not surprisingly, the new amendments also focus 
heavily on the use of students’ Social Security numbers. 
The amendments clarify that using a student’s Social 
Security number as an identification element when dis- 
closing or confirming directory information is prohibited 
unless the student has provided written consent for the 
disclosure. 

You may disclose student ID numbers as directory 
information if they qualify as electronic personal identi- 
fiers by essentially functioning as a name. They cannot 
be used solely to authenticate identity or gain access to 
education records. 

Many directories that support electronic information 
systems used to deliver certain student services require 
disclosure of a user name or other personal identifier 
when students gain access to these systems. They include 
Web-based class registration, access to academic records, 
and library resources. 

Amended FERPA regulations allow these electronic 
personal identifiers to be designated as directory infor- 
mation, including student ID numbers, only if the 
identifier functions essentially as a name. 

Disclosure 

In light of the new amendments, “disclosure” now 
excludes returning an education record or information 
from a record to the party identified as the record’s 
creator or provider. 


This change allows school districts to access informa- 
tion originally provided to a state-consolidated record 
system without violating the statutory prohibition on 
redisclosure. Districts are not authorized to release or 
transfer education records to a student’s previous institu- 
tion that is not identified as the source of those records. 

The amendments now also allow schools to return 
questionable documents, such as transcripts, letters 
of recommendation, and other files, to the sender for 
verification. 

Definition of Education Records 

The amended regulations clarify that postenrollment 
records pertaining to an individual’s previous attendance 
are considered “education records,” regardless of when 
they were created or received by an institution. 

The final regulations, codifying prior court decisions, 
create an express exception to the definition of “education 
records” that excludes peer-on-peer-graded papers before 
a teacher collects and reads them. This exclusion clarifies 
that peer grading does not violate FERPA and should be 
conveyed to your district’s teaching staff as such. 

School Officials Exception 

The school officials exception underwent many changes 
and clarifications under the new amendments in light of 
the fact that the term “school officials” has been 
expanded to include contractors, consultants, volunteers, 
and other outside service providers that perform institu- 
tional services and functions. So what does the 
expansion of this exception mean? 

If a contractor or other outside service provider is 
given access to education records, that access must be 
under the direct control of the disclosing institution, that 
is, your school district. This use is subject to the same 
conditions on use and redisclosure of these records that 
govern other school officials under FERPA regulations. 

Contractors must also ensure that only individuals 
with legitimate educational interests have access to stu- 
dents’ personally identifiable information in the 
education records created or maintained on behalf of the 
district. They also may not redisclose this information 
without consent unless the district has authorized the 
redisclosure under a FERPA exception and records the 
subsequent disclosure. 

Your district also may not disclose education records 
to any outside service provider under this exception 
unless you have specified in your annual FERPA notifi- 
cation that you use contractors, consultants, and volun- 
teers as “school officials” to provide certain services 
and functions key to the operation of your institution. 

This exception permits disclosure only if you out- 
source a service that your district would otherwise 
provide using its own employees. Note that recording 
a disclosure to an outside service provider does not 


www.asbointl.org 


SCHOOL BUSINESS AFFAIRS | APRIL 2010 23 


waive your requirement to comply with the annual noti- 
fication mandate. 

Control of Access to Education Records 
by School Officials 

The latest amendments require school districts to use 
“reasonable methods” to ensure that teachers and other 
school officials, including outside service providers, 
obtain access to only those paper or electronic records in 
which they have legitimate educational interests. 

High-risk records, such as Social Security numbers and 
other information that could be used for identity theft, 
should generally receive greater and immediate protec- 
tion than medium- or low-risk records. 

Records to a Student’s New School 

Prior FERPA regulations allowed school districts to dis- 
close education records, without consent, to officials of 
another school system or postsecondary institution 
where a student “seeks or intends to enroll.” 

The amended regulations clarify the “seeks or intends 
to enroll” language to show that the authority to disclose 
or transfer education records — including health and dis- 
ciplinary records — to a student’s new school does not 
cease automatically the moment a student has enrolled 
and continues to be in effect for any disclosures related 
to a student’s enrollment or transfer. 

This clarification now allows a student’s previous 
school to supplement, update, or correct any records it 
sent during a student’s application or transfer period — 
something previously unclear under FERPA. 

Ex Parte Court Orders under the 
USA PATRIOT Act 

The new changes allow school districts, per ex parte 
court orders under the USA PATRIOT Act, to disclose 
records to the attorney general without the typically 
required consent or notice to the parent or student if 
the school district ensures the order’s validity. 

Registered Sex Offenders 

The amended regulations add a new exception that 
allows school districts to disclose, without consent, 
information received from a state under the Wetterling 
Act about a student who is required to register as a sex 
offender in the state. 

Identification and Authentication of 
Identity of Parties Requesting Education 
Records Disclosure 

Under the latest FERPA amendments, school districts 
must use reasonable methods to identify and authenti- 
cate the identity of parents, students, school officials, 


and any other parties to whom they disclose education 
records. Prior regulations did not address this issue. 

Districts may use personal identification numbers, 
passwords, personal security questions, “smart cards” 
and tokens, biometric indicators, or other factors known 
or possessed only by the user as appropriate in the con- 
text of electronic disclosure. 

Health and Safety Emergencies 

If the district determines that there is an explainable and 
significant threat to the health or safety of a student or 
other individuals, the school may disclose information 
from education records to appropriate parties whose 
knowledge of the information is necessary to protect the 
health and safety of the student or other individuals. 

The final regulations remove the “strict construction” 
of such health and safety emergency provisions. Instead, 
they now give education agencies the ability to consider 
that totality of circumstances in respect to how a threat 
pertains to the safety and health of students and other 
individuals. 

Student Identification and Communication 
in Class for Opt-Outs 

The most recent changes clear up debate on the fact that 
if a student opts out of directory information disclosures, 
it does not prevent schools from identifying that student 
by name or from disclosing a student’s electronic identi- 
fier or institutional e-mail address in class. 

Enforcement Provisions 

The latest amendments allow the U.S. Department of 
Education’s Family Policy Compliance Office to investi- 
gate allegations made by either school officials or other 
nonparent or nonstudent parties on the grounds that 
FERPA has been violated. 

Subject to investigation is information brought to the 
attention of the Family Policy Compliance Office by 
media reports. 

Understanding the Regulations 

The vast number of changes in the latest revisions to 
FERPA can be overwhelming, to say the least. The final 
regulations include different nuances and interpretations 
of education records privacy than in the past. 

Experienced legal counsel can help you wade through 
this sea of updates and review your school district’s cur- 
rent privacy policies to ensure that you are compliant 
with the new changes. No one wants a visit from an 
enforcement officer regarding FERPA violations. 


Christine Cossler is an associate with Walter & Haverfield, LLP, 
Cleveland, Ohio. Email: ccossler@walterhav.com 
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